Remote opportunity at
GitLabIntermediate Security Analyst, Vulnerability Operations (North America)
GitLab, an intelligent orchestration platform for DevSecOps used by millions, is seeking an Intermediate Security Analyst for its Product Security Vulnerability Operations team. Operating remotely across…
Career Tools
About This Role
GitLab, an intelligent orchestration platform for DevSecOps used by millions, is seeking an Intermediate Security Analyst for its Product Security Vulnerability Operations team. Operating remotely across North America with a preference for candidates on the West Coast of the US or Canada, this position focuses on protecting customers by triaging security reports, supporting vulnerability management operations, and handling communications with researchers and internal groups. This role is well-suited for early-career…
Job Description
GitLab, an intelligent orchestration platform for DevSecOps used by millions, is seeking an Intermediate Security Analyst for its Product Security Vulnerability Operations team. Operating remotely across North America with a preference for candidates on the West Coast of the US or Canada, this position focuses on protecting customers by triaging security reports, supporting vulnerability management operations, and handling communications with researchers and internal groups.
This role is well-suited for early-career security professionals who possess strong organizational skills, curiosity, and a high level of detail orientation. The professional filling this position will collaborate closely with multiple departments including Product Security Incident Response Team (PSIRT) engineers, Legal, Customer Success, and Support.
Daily responsibilities involve evaluating bug bounty submissions, validating findings, tracking vulnerabilities through remediation, and contributing to CVE assignment activities as a CVE Numbering Authority representative. Analysts will also monitor operational metrics, draft security advisories, and build deep expertise in product security response and coordinated vulnerability disclosure.
Responsibilities
- Triage incoming bug bounty reports by reviewing quality, validating findings, assessing impact, identifying duplicates, and routing to proper teams
- Track vulnerabilities identified through management activities through assessment, remediation, and closure
- Collaborate with PSIRT engineers and developers to gather technical data, reproduce problems, and clarify affected versions
- Support severity scoring utilizing CVE, CVSS, CWE, and OWASP frameworks
- Maintain professional communication with security researchers during bug bounty and disclosure programs
- Prepare information for CVE assignment, maintain accurate records, and act as a CNA representative
- Draft customer-facing alerts regarding security vulnerabilities, fixes, and release details alongside internal stakeholders
- Track issue metrics and operational queues to detect trends and eliminate aging items
- Build and update runbooks, templates, and procedures to enhance vulnerability handling
- Take part in incident handoffs, root cause analyses, and product security reviews
Requirements
- Early-career experience or equivalent education in cybersecurity, software engineering, information technology, or related fields
- Foundational familiarity with software vulnerabilities, web applications, APIs, CI/CD environments, authentication, and authorization
- Working knowledge of terminology including CVE, CVSS, CWE, and the OWASP Top 10
- Strong attention to detail with the capacity to manage and prioritize multiple work items
- Clear written and verbal communication abilities appropriate for various audiences
- Prior exposure to vulnerability disclosure platforms like HackerOne or Bugcrowd
- Residency in North America, with preferred locations on the West Coast of the US or Canada
Qualifications
- Basic scripting, log analysis, issue tracking, or data analysis experience
- Experience authoring technical documentation, customer communications, support replies, or operational processes
Core Skills
Benefits
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation and Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this job fully remote?
Yes, this is a remote position open to candidates across North America, with a preference for individuals based on the West Coast of the United States or Canada.
What is the employment type?
This is a full-time position.
What is the salary for this role?
The US base salary range for this level is between $115,000 and $150,000 USD, though exact compensation depends on factors such as location, experience, and equity.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.